Trichotillomania.com

Privacy Policy

Last updated: 19 October 2026

The short version

We run this site to help people with trichotillomania and their families — not to harvest data. Here's the whole policy in four sentences:

We collect the minimum we need: your email if you subscribe, your payment details (handled by Stripe, never stored by us) if you buy the Parent's Guide, and the professional details therapists choose to publish in the directory (plus a short-lived note if a therapist starts that form and doesn't finish it, so we can offer a hand). We never ask you to tell us about your health, and we never sell or rent anyone's data to anyone. We don't run ads. You can ask us what we hold about you, or ask us to delete it, at any time.

The rest of this page is the detail, in plain English.

Who we are

trichotillomania.com is operated by IPSU VENTURES LTD, a company registered in England and Wales (company number 12656961). Registered office: 82a James Carter Road, Mildenhall, Bury St. Edmunds, England, IP28 7DE.

For anything to do with your data, contact us at hello@trichotillomania.com. We're the "data controller" for the personal data described on this page, under the UK GDPR and the Data Protection Act 2018.

A note about privacy and health

We know that for many visitors, simply being on this site is private. Trichotillomania is a condition most people hide, and we take that seriously.

  • We never ask you to tell us about your health. Nothing on this site requires you to disclose that you, or your child, pulls hair. Newsletter signups and purchases work exactly the same whether you have trich, are a parent, a therapist, or just curious.
  • We don't run ads, we don't use advertising trackers, and we don't share browsing data with ad networks or data brokers.
  • If you email us and choose to share personal details about your or your child's experience, we treat that as confidential. We use it only to reply to you, we don't add it to any database, and we delete it in line with the retention periods below.

What we collect, and why

If you just browse the site

Our hosting provider, Vercel, automatically processes technical data needed to serve pages — your IP address, browser type, and the pages requested. This is standard server-log data, kept for a short period and used for security and keeping the site running. Legal basis: our legitimate interest in operating a secure, working website.

We use Hotjar to see how pages are used — heatmaps and recordings of scrolling, clicks and taps — so we can make the site easier to use. Hotjar masks the text you type into forms and stores IP addresses only in truncated form. Legal basis: our legitimate interest in improving the site. You can opt out of Hotjar on every website at hotjar.com/policies/do-not-track.

If you accept analytics cookies (see Cookies below), we also use Google Analytics 4 to understand how the site is used — which pages are read, how visitors arrive, and roughly where in the world traffic comes from — so we can make the site more useful. Google Analytics 4 does not log or store IP addresses. Google Analytics runs only if you consent, and the site works exactly the same if you decline. Legal basis: your consent, which you can withdraw at any time via the cookie settings.

If you subscribe to the newsletter

We collect your email address, and use it to send you the emails you signed up for — new articles, practical tips, and occasional updates about the site. Legal basis: your consent. Every email includes an unsubscribe link, and unsubscribing takes effect immediately. Your address is stored with our email service provider, who processes it only on our instructions.

We don't segment subscribers by anything health-related, and subscribing tells us nothing about whether you have trich.

If you take the trichotillomania quiz

The quiz asks about hair pulling, so your answers are information about your health (or your child's). Here is exactly what happens to them.

  • While you take it, your answers stay in your browser. Nothing is saved to your device, and nothing about your answers ever goes into the web address, so it can't end up in browser history or analytics.
  • When you finish, we keep an anonymous record: the country version of the site you used, who the quiz was for (yourself or your child), the age range, the answers, the result, and whether you went on to enter an email address. There is no name, email address, IP address or anything else that could identify you in that record, and it is never joined to your email address. We use these records only for counts — how many people finish, where they drop off — and we delete them after 24 months. Legal basis: our legitimate interest in understanding whether the quiz helps people, using data that can't be tied to anyone.
  • If you ask for your results by email, we use your email address (and first name, if you give one) to send you one email with your results. We do this only if you tick the box agreeing to it, and we keep a record of that agreement. The email is sent through our email service provider, who processes it only on our instructions. That is the only email the quiz sends; there is no follow-up series. Legal basis: your explicit consent, which you can withdraw by asking us to delete the record.
  • If you also tick the newsletter box, we add your email address, first name and country version of the site to the newsletter list, exactly as if you had subscribed from any other page. Nothing from the quiz — not your answers, your result, nor whether it was for you or your child — is added to your newsletter record, so subscribing still tells us nothing about whether you have trich. Legal basis: your consent.
  • If you're under 16 and take the quiz for yourself, we don't ask for an email address at all. Your results are shown on screen only.

The quiz is not a diagnosis, and we never use quiz answers to decide what to show or send anyone.

If you ask us to tell you when a practitioner lists near you

On a directory page for a country that has no listings yet, you can leave your email address to be told when someone lists there. We store the address and the country you asked about, and use them to send you that one email. This does not add you to the newsletter. Legal basis: your consent.

If you buy the Parent's Guide

To deliver your purchase we process your email address (to send the download and receipt) and order details (what you bought, when, and the amount). Legal basis: performing our contract with you.

Payment details are handled entirely by Stripe, our payment processor. Your card number never touches our servers and we never see or store it. Stripe's own privacy policy covers how they handle payment data: stripe.com/privacy.

If you request a refund under the 30-day guarantee, we process the emails involved in order to issue it, and we keep records of transactions and refunds for as long as UK tax and accounting law requires (six years).

If you're a therapist listed in the directory

The directory exists to be public — that's the point of listing. When you apply to be listed, we collect the professional details you provide: name, credentials and registrations, practice location(s), contact details, and the description of your practice. Legal basis: performing our agreement with you to publish your listing.

Two things worth knowing:

  • Your listing is published on the open web and will be indexed by search engines and AI tools. Only include contact details you're happy to make public.
  • You can update or remove your listing at any time by contacting us at hello@trichotillomania.com. Removal from the site is prompt, though search engines may cache old copies for a while — that part is outside our control.

We may verify credentials you provide against public professional registers before publishing.

If you start the listing form and don't finish it. The first step creates your account, and from then on everything you enter is saved to a draft listing as you go, so you can come back and finish later by signing in with the same email and password. The draft is only ever visible to you and to us; nothing is published until you complete the form and pay. We also keep a short progress record — your email address, your name, the professional role you picked, the country you were listing in, and how far through you got — so we can see that someone got stuck and offer to help. Legal basis: taking the steps you've asked us to take towards listing you, and our legitimate interest in helping applicants finish. The progress record is deleted as soon as you complete your application, and in any case after 90 days. Your account and draft listing stay until you finish or ask us to remove them: email hello@trichotillomania.com and we'll delete both.

If you contact a therapist through the directory

The "Email me" button on a listing relays your name, email address and message to that therapist by email, with your address as the reply-to so they can answer you directly. We don't store the message or your details — it goes to them, not to us. What we do keep is a count: that a listing received an enquiry, and that a visitor clicked through to a listing's website, along with the listing's location. Nothing about you is recorded with it — no name, email, IP address or browser details — so it can't be tied back to you. We use these counts to see which listings and locations the directory is helping, and to show therapists whether their listing is working. Legal basis: our legitimate interest in running a useful directory.

If you email us

We keep the correspondence for as long as needed to deal with your enquiry, then delete it in line with the retention section below. If your email relates to a purchase or a legal matter, we may need to keep it longer.

Cookies

We keep cookies to the minimum:

  • Essential cookies — set during checkout by Stripe to process your payment securely and prevent fraud. These don't need consent because checkout can't work without them.
  • Analytics cookies (optional) — set by Google Analytics 4, only if you accept them in the cookie banner. They help us see how the site is used so we can improve it.
  • Hotjar cookies — set by Hotjar to tell one visit from the next for heatmaps and session recordings. See "Hotjar" above for how to opt out. You can decline them, or change your mind later, and everything on the site still works.

We don't use advertising or cross-site tracking cookies.

Who we share data with

We share personal data only with the service providers who make the site work, only for the purposes above, and under contracts that require them to protect it:

  • Vercel — website hosting
  • Stripe — payment processing
  • Google (Google Analytics 4) — website analytics, only with your consent
  • Hotjar — heatmaps and session recordings
  • Our email service provider — newsletter and transactional email

We would also disclose data if the law genuinely required it (for example, a valid legal order), or as part of a sale or transfer of the site itself — in which case this policy would continue to apply to your data and we'd notify subscribers.

We never sell or rent personal data. We never share it with advertisers or data brokers. There are no exceptions to this.

International transfers

Some of our providers are US companies, so data may be processed outside the UK. Vercel, Stripe, and Google are each certified under the EU–US Data Privacy Framework and its UK Extension, which the UK government recognises as providing adequate protection for personal data transferred to the US. Where any transfer isn't covered by that certification, it's protected by the UK's approved standard contractual safeguards instead.

How long we keep things

  • Newsletter emails: until you unsubscribe, after which your address is removed from our mailing list.
  • "Tell me when a practitioner lists" requests: until we have sent you that email, or you ask us to remove your address.
  • Quiz records: the anonymous answer records for 24 months; the record of your consent to the results email for as long as we need to show that consent was given, or until you ask us to delete it.
  • Purchase and refund records: six years, as required by UK tax and accounting law.
  • Directory listings: for as long as you choose to be listed, plus a short administrative period after removal.
  • Unfinished listing applications: the progress record is deleted as soon as the application is completed, and in any case after 90 days; the account and draft listing stay until you finish or ask us to delete them.
  • Directory enquiry and click counts: kept indefinitely — they contain nothing that identifies a visitor.
  • General correspondence: deleted within 12 months of the enquiry being resolved, unless it relates to a purchase or legal matter.
  • Analytics data: retained by Google Analytics for up to 14 months, and by Hotjar for up to 12 months, then automatically deleted.
  • Server logs: kept by Vercel for a short period for security and reliability purposes.

Your rights

Under the UK GDPR you have the following rights, and we honour them for everyone regardless of where you live:

  • Access — ask for a copy of the personal data we hold about you
  • Correction — ask us to fix inaccurate data
  • Deletion — ask us to erase your data (we'll comply unless we're legally required to keep something, like tax records)
  • Objection and restriction — object to or limit certain processing
  • Portability — receive your data in a usable format
  • Withdraw consent — at any time, for anything based on consent (like the newsletter or analytics cookies)

To use any of these, email hello@trichotillomania.com. We'll respond within one month. We may need to verify you're the person the data relates to before acting.

You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ico.org.uk). If you're in the EU/EEA, you can complain to your local data protection authority instead.

Children

This site is written for adults — including parents of children who pull their hair. It isn't directed at children, and we don't knowingly collect personal data from anyone under 13. If you believe a child has given us personal data, contact us and we'll delete it.

A parent buying the Parent's Guide, or taking the quiz for their child, gives us their own data, not their child's. We never ask for — and please don't send us — identifying information about your child. Someone under 16 who takes the quiz for themselves is never asked for an email address.

Security

We use reputable providers, HTTPS across the whole site, and access controls on the systems that hold personal data. Payments are handled by Stripe, which is certified to the highest payment-industry security standard (PCI DSS Level 1). No system is perfectly secure, but we deliberately hold as little data as possible — the safest data is the data we never collected.

Changes to this policy

If we change this policy in any meaningful way, we'll update the date at the top and, for significant changes affecting subscribers or customers, tell you by email. Minor clarifications may be made without notice.

Contact

Questions, requests, or concerns about your data: hello@trichotillomania.com

IPSU VENTURES LTD 82a James Carter Road, Mildenhall, Bury St. Edmunds, England, IP28 7DE